Hacker News Reader

Comment by ReverseCold | Hacker News Reader

$35 + some technical/tutorial-following knowledge to setup an IKEv2/OpenVPN server on a Raspberry Pi is better than $100/year for a VPN provider if your threat model is just "Open WiFi is sketchy" or "XYZ network blocks YouTube"

View on HN

Many people are not simply paying for an encrypted connection, they're mainly paying for a) an IP that cannot be easily attributed back to them, and b) a large garbage can for DMCA complaints.

The Raspberry Pi provides neither of those, and requires occasional maintenance.

I agree, but > if your threat model is just "Open WiFi is sketchy" or "XYZ network blocks YouTube"

He listed the reasons where this is useful. And it definitely is useful for those reasons. Your list is unrelated.

in my experience a lot of people are paying for the experience of a vpn provider that, without putting it in writing on their sign up page, basically sends DMCA abuse emails to /dev/null , and if US-based, will require a court order or subpoena to divulge subscriber details. For fully automated DMCA abuse threat emails, the cost of the manual labor (on the part of the threat-sender) is too high to individually attempt court orders or subpoenas of VPN ISPs for a particular customer, except in very exceptional circumstances.

How do customers identify these providers?

1) PIA is less than $35 a year

2) PIA takes less than a minute to setup on every device. Download the app, login, and you pretty much never have to worry about it again.

Your alternative is more expensive, more resource-hungry, and more of a pain in the ass.

... and values your time next to nil.

Also as someone who has a couple of Raspberry Pis in his house, memory card corruption is real and it’s annoying as hell. If I wanted an OpenVPN gateway I would not want to run it on Raspbian. Maybe on a distro that runs purely in memory after boot.

But like the other person said, if you value your time it is almost certainly not worth spending time on setting this up yourself, even if memory card corruption was not an issue.

I am also super hesitant to rely on a raspberry pi for anything that should really work, networking related, considering that the ethernet interface is actually a USB 2.0 device hung off a very cheap USB bus. It's not like having an Intel or Broadcom PCI-Express interface NIC on the motherboard of an x86-64 platform PC. It also has only one NIC. All of the methods to get >1 NIC on a raspberry pi use additional USB devices and are ugly hacks IMHO.

If you are experiencing corruption issues you are likely using a USB power supply that is not sufficent, for the rpi3 you need at least a 2.5 amp supply to ensure reliability.

One major benefit to running your own is that a non-zero number of PIA's IPs are blocked on many sites. A random VPS IP is much less likely to be.

I ran into that at times, but it's so infrequent, I don't consider it a drawback.

Please make sure to report that to PIA support, they do have some solutions available. Worst case, it gives them evidence that it's time to rotate IPs.

> a non-zero number of PIA's IPs are blocked on many sites

The Swiss and Norwegian servers are blocked on almost no sites.

I've actually found the opposite to be true. Sites seem to focus more on preventing scraping and block VPS IP's more often than commercial VPN. For example, Craigslist on Digital Oceans IP's is hilariously throttled to ~256 bytes per second. Crunchbase always tosses up a CAPTCHA. This was mostly the same for Linode.

Ironically, 256 bytes per second is probably still enough to make Craigslist usable... Web design right out of the 1200 baud modem era :-)

They've zapped some of my AWS subnets but not others. It doesn't appear to be a dynamically updated blacklist.

Craigslist blocks PIA. I find the utility steadily decreasing as more and more sites block their addresses.

there are a pretty large number of commercial openvpn service providers, that if you pay for 1 or 2 years of service, the cost will range from $2.80/month to $5.50/month. I would be surprised to pay $10/month. I have my own OpenVPN endpoint for testing which exists on a $5/month VPS, but it has a 2TB/month transfer quota, while many commercial openvpn service providers have no transfer quota per month.

Ideally you want to have both, if you move a lot of vpn traffic (cough cough, 4k HEVC torrented things), you can have your own openvpn setup on a KVM VPS you fully control with root, and also a commercial $3/mo openvpn service where you won't run into a 1 or 2TB/mo limitation.

here's the pricing for a fairly normal commercial openvpn service provider:

https://www.purevpn.com/order

You can also use http://lowendspirit.com/locations.html to get a VPS for as little as $3/year then use https://github.com/Nyr/openvpn-install for a quick openvpn installation.

or random VPS operators from lowendbox.com, anywhere in the $2 to $4/mo range.

This is like the comment on the Dropbox thread when it launched. "Why would I pay for this when I can [insert 5-step process here that is not at all easy for the vast majority of population]?"

In case anyone else was curious:

> For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem.

https://news.ycombinator.com/item?id=8863

Am I the only one that does both? I use OpenVPN to connect from my remote devices to my home router. My home router then uses an OpenVPN tunnel to PIA for all Internet bound traffic.

For those saying that anyone setting this up at home doesn't value their time, my router has built-in support for OpenVPN in both server and client mode. The VPN connectivity and tunnel to PIA took me about 15 minutes to configure a couple of years ago and besides having to update the PIA password has required no real maintenance.

For many, I'm sure they feel their time and/or convenience is worth more than the price difference. It doesn't take a ton of time, but it's enough of a time/effort that I don't think it's wrong to assume that many just want to sign up for a service and have it work instead of building their own.

This suggestion assumes time has a cost of zero. Not to mention, some solid VPN services (Mullvad) can be had much less than $100/year.

That said, it could be a fun project regardless.

Can you elaborate on this setup? A portable VPN server, is that correct? You have a Pi that has openvpn installed and you connect to the Pi? Do you have issues with captive portals example the coffee shop or hotels?

https://news.ycombinator.com/item?id=9224

Who is going to host the Raspberry Pi, and do they guarantee they're not keeping connection logs?

You could ask the same people who host PIA servers to host your RPi, given that PIA don’t run their own network.

PIA state they don’t keep logs on their servers, they can’t provide those guarantees on the network as they don’t run the networks they operate on.

Plus colo and transit costs more than paying for a slice of resource someone else is already hosting, so there goes that price model.

lolwat.

Hey PIA, mind if I throw my little server in your datacenter? No you can't access it though. I promise it'll be properly secured! Hey! Why are you walking away?

This is actually less insane than it sounds. Most VPN providers rent space at traditional datacenter providers like Equanix. Search for "dedicated server hosting" and "colocation providers" for the exact same list of vendors that the VPN companies consider.

You enter into a colocation agreement, and that's pretty much how it works. Instead of walking away, they quote you a price.

Very true! Unfortunately, your RPi is going to have only one user in responsible for traffic. Commercial VPN providers act as a multiplexer to hide who is responsible for what traffic. Ideally you'd have at least a Type III anonymous remailer mixing your traffic, but then you're dealing with much higher latency. As with everything, there is a compromise between the effort required to break a security system, the ease of detecting such a break, and the burden of using the system.

I'm not sure what point you're making about colo and transit costs. Are you saying that operating your own has higher costs? Or that a commercial VPN provider has higher costs? I'd be very interested in a price analysis that beats PIA while offering a remotely similar security profile. Keeping an RPi at your house provides defense against totally different threats.

> PIA state they don’t keep logs on their servers, they can’t provide those guarantees on the network as they don’t run the networks they operate on.

Do you have a source on this?

If the Raspberry Pi is in your house then any site you visit (or any frames they embed or other resources they load) can still track you by IP.

People who go this route are likely more concerned with security than having anonymity

Given that it's named Private Internet Access, I would think many of their customers are also concerned about privacy.

If a Raspberry Pi self-hosted VPN gets you what you need, great, but it doesn't do the same things as a large VPN service where your traffic is mixed in with all the other users exiting from the same server.

Sorry I should’ve been more clear. I meant that people who go the route of setting up their own vpn server are more concerned with security. I think we’re on the same page, and I agree with you about the importance of privacy to PIA users.

The point is to create a transparent SSH or IPsec tunnel from your home network. The raspberry pi is one endpoint of that tunnel, the VPS is the other endpoint.

Ah, I see. Seems like that would still be easy to isolate a house’s VPN traffic from the typical connections coming out a server, but it takes some guesswork, protects your home IP address, and keeps your ISP from seeing what you’re doing.

Reply on news.ycombinator.com